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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



MICHAEL GARRICK O'BRYAN, JR. 

Plaintiff, 



Case No: 1 :06CV00050 RJL 



V. 



THE HONORABLE GORDON R. 

ENGLAND, in his official capacity as 
SECRETARY OF THE UNITED 
STATES NAVY 

Defendant. 



DECLARATION OF DOUGLAS KIRBY 

I, DOUGLAS L. KIRBY, declare the following to be a true and correct statement of 
facts: 

1 . I am employed as an Information Assurance Specialist under the Command's 
Information Assurance Manager (lAM) in the Personnel and Information Security 
Branch, within the Security Office, Space and Naval Warfare Systems Center, San Diego 
(SSC San Diego). I am also the Information Assurance Officer (lAO) liaison for SSC 
San Diego. My assigned responsibilities include searching for documents requested 
pursuant to the Freedom of Information Act and Privacy Act (FOIA/PA), when requested 
by the Command FOIA/PA Officer. 

2. The statements I make in this declaration are based on my own personal knowledge, 
the knowledge I acquired in the performance of my official duties, and my review of the 
official files and records of SSC San Diego. 

3. Commencing February 6, 2006, at the request of the Command FOIA/PA Officer, I 
conducted a search for documents requested by Plaintiff Michael O'Bryan, as set forth in 
his letter attached as exhibit A to his complaint. I searched, or caused to be searched, all 
record systems likely to contain documents responsive to Plaintiffs request. It should be 
noted that Plaintiffs request seeks documents concerning NMCI computer Room 228 in 
Building 40 for the period April 2001 through September 2002, previously called the 
"Green Team Lab" and currently managed by Tom Kelly. There were no responsive 
documents for Room 228. In fact. Room 228 was not a classified computer room. 
However, after March 29, 2001, due to a physical reconfiguration of the lab spaces, a 
Green Team Lab was also located within the perimeter of a classified Open Storage 
Secret (OSS) area comprised of Rooms 222, 223, and 224 in Building 40. Mr. Tom 
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Kelly was the prior lab manager for Room 223 and Room 223, Building 40, appeared to 
best resemble the lab configuration diagram provided by Mr. O'Bryan in enclosure (1). 
Therefore, after consultation with the Command FOIA/PA Officer, I expanded the search 
for documents to include the reconfigured Green Team OSS. 

4. Plaintiffs request number 1 was for "Information Technology security incident 
and/or violation investigation reports including all findings, opinions, conclusions, 
written statements, and a synopsis of all conversations, for the NMCI computer room 
#228 at SSC-SD Building 40 previously called "Green Team Lab" currently managed by 
Mr. Tom Kelly, for the period APR 2001 - SEP 2002." I caused a search to be 
conducted for Command Security Violations for the time period of calendar years (CY) 
2001 and 2002. I maintain a Command- wide accreditation file system. I searched the 
accreditation file system by organizational code, room and building number. There were 
no Information Technology security incidents nor violation reports found for Room 228 
in Building 40 during the periods CY 2001 through CY 2002. Two reports were located 
for Room 224 in Building 40. These reports were provided to the Command FOIA/PA 
Officer. 

5. Plaintiffs request number 2 was for "Computer related acceptable use policy in effect 
during 2001 and 2002 for the NMCI computer room #228 at SSC-SD Building 40 
previously called "Green Team Lab" managed by Mr. Tom Kelly." In order to perform 
my official duties, I am required to be familiar with the computer use policies. Prior to 
October 24, 2002, Department of Defense Directive (DODD) 5200.28, Security 
Requirements for Automated Information Systems (AIS), SECNAVINST 5239.3, 
Department of the Navy Information Assurance (lA) Policy, and OPNAVINST 5239. IB, 
Navy Information Assurance (lA) Program, were in effect. On October 24, 2002 DODD 
5200.28 was superceded by DODD 8500.1, Information Assurance (lA). Copies of these 
Directives and Instructions were provided to the Command FOIA/PA Officer. 

6. Plaintiffs request number 3 was for "Document that specifies who was appointed as 
the hiformation Systems Security Officer and/or Manager (ISSO/M) for the NMCI 
computer room #228 at SSC-SD Building 40 previously called "Green Team Lab" 
currently managed by Mr. Tom Kelly, for the period APR 2001 - SEP 2002." 

As the Information Assurance Officer (lAO) liaison for SSC San Diego, I maintain 
records of lAO appointments (formerly called Information System Security Officer 
(ISSO)) in my office. A copy of the appointment was provided to the Command 
FOIA/PA Officer. 

7. Plaintiffs request number 4 was for "Standard operating procedures and/or security 
policies and procedures (which were in effect during 2001 and 2002) for the NMCI 
computer room #228 at SSC-SD Building 40 previously called "Green Team Lab" 
managed by Mr. Tom Kelly." Security policies and procedures are maintained in my 
office. I conducted a search and located the responsive documents, which were provided 
to the Command FOIA/PA Officer. 
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8. Plaintiffs request number 5 was for " Document designating who was a classifier of 
information for work completed in the NMCI computer room #228 at SSC-SD Building 
40 previously called "Green Team Lab" managed by Mr. Tom Kelly, which was in effect 
in 2001 and 2002. " In order to perform my official duties, I am required to be familiar 
with the instructions governing classifier of information. Accordingly, a copy of 
SECNAVINST 5510.36, Department of the Navy Information Security Program (ISP) 
Regulation, was provided to the Command FOIA/PA Officer. 

9. Plaintiffs request number 6 was for "The 2001-2002 computer accreditation 
packages and/or the dates of accreditation for the computer systems in computer room 
228 at SSC-SD building 40 previously called "Green Team Lab" managed by Mr. Tom 
Kelly". Command-wide computer accreditation records are maintained in my office and 
filed by accreditation status, organizational code, room and building number. There was 
no classified computer equipment in Room 228 and accordingly no local Designated 
Approving Authority (DAA) classified system accreditation package was located for 
Room 228. The Green Team Lab in Room 223 did not have a request to process 
classified information in CY 2001 and CY 2002 and accordingly no local Designated 
Approving Authority (DAA) classified system accreditation package was located for 
Room 223. However, Lab 224 in Building 40 did have a request for lab systems to 
process SECRET/INTEL information. Accreditation records were provided to the 
Command FOIA/PA Officer. Furthermore, at SSC San Diego, systems that are not 
DAA accredited to process classified information are instead "blanket approved" 
Command-wide by the local DAA to process and transmit Sensitive Unclassified 
information. Unclassified Computer systems in Room 223 were accredited to transmit 
Sensitive Unclassified information by DAA Blanket Final accreditation memo Serial 
D0353/46-01 of 9 May 2001. This accreditafion memo has been superceded by DAA 
blanket approval memo Ser 20351/80-04. DAA Blanket Final accreditation memo Serial 
D0353/46-01 of 9 May 2001 has been purged under the commands system for purging 
superceded records. DAA blanket approval memo Ser 20351/80-04 and accreditation 
records relating to Room 223 were provided to the Command FOIA/PA Officer. 

10. Plaintiffs request number 7 was for "Any accreditation information related to the 
classified desktop computer on the "build bench" table in room #228, SSC-SD Building 
40, described in the attached diagram, in the NMCI Green Team computer room on 
Monday, 1 8 March 2002." I could not determine which desktop computer was 
referenced in Plaintiffs request. Desktop computers must each be plant property bar 
coded and recorded in the SSC San Diego corporate Enterprise Resource Planning (ERP) 
database for tracking. Plaintiff did not specify a barcode identifier to research the 
corporate Information Assurance database for a specific desktop system accreditation 
approval status. Nevertheless, no classified system accreditation package was found for 
Room 228, Building 40. Accreditation documentation relating to Rooms 223 and 224 
was provided to the Command FOIA/PA Officer, as set forth in paragraph 9 of this 
declaration. 

1 1 . Plaintiffs request number 8 was for "Inventory documentation for information 
system hardware for the APR 2001 - SEP 2002 time period in the NMCI computer room 
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#228 at SSC-SD Building 40, previously called "Green Team Lab," currently managed 
by Mr. Tom Kelly." I caused to be searched the command corporate database for plant 
property inventory. Room 228 did not contain computer inventory and therefore there 
are no responsive documents for that location. A responsive document was located for 
Room 223 and provided to the Command FOIA/Privacy Officer. 

12. Plaintiffs request number 9 was for "All System Security Authorization Agreements 
(SSAA) in effect during 2001 and 2002 for the NMCI Green Team computer room. 
Including computers and networks (SIPRNET and/or NIPRNET), at SSC-SD Building 
40,room #228, previously called "Green Team Lab" managed by Mr. Tom Kelly." In 
order to perform my official duties, I am required to be familiar with the computer 
accreditation process at SSC San Diego. During CY 2001 and CY 2002, SSC San Diego 
systems were not accredited under Defense Information Technology Security 
Certification and Accreditation Process (DITSCAP) System Security Authorization 
Agreement (SSAA) documentation. Accreditation documentation was provided to the 
Command FOIA/PA Officer, as set forth in paragraph 9 of this declaration. 

13. Plaintiffs request number 10 was for "Any documentation of security training prior 
to March 18, 2002, for the government and contractor personnel working in room #228 at 
building 40 SSC-SD, formally called "Green Team Lab" managed by Mr. Tom Kelly." 
SSC San Diego Security Office does not maintain security training material for security 
training prior to March 2002, as requested by plaintiff The Command Training 
Coordinator maintains security training materials in the Physical Security Office and CY 
2002 security training materials have been updated with newer materials and older 
materials are no longer in existence. 



I declare under penalty of perjury that the foregoing is true and correct. Executed on 




J 

DOUGLAS L. KIRBY 



